Who Will Take The Privacy Seppuku Pledge?

from the after-you dept

When Techdirt wrote recently about yet another secure email provider opting to close down its service rather than acquiesce in some future US government demand to spy on its users, we noted that Cryptocloud has promised something similar for a while -- what it terms "corporate seppuku":

In the context of privacy issues, "corporate seppuku" means shutting down a company rather than agreeing to become an extension of the massive, ever-expanding, secretive global surveillance network organized by the U.S. National Security Agency. It means, in short, saying "no." Sometimes, we hear people say that this or that company "had no choice" in what they did. Bullshit. There's always a choice; it's just that the consequences of certain options might be really severe, and are thus not chosen. But that's a choice. It's always a choice.

It has even formulated what it calls the Privacy Seppuku pledge:

if a company is served with a secret order to become a real-time participant in ongoing, blanket, secret surveillance of its customers... it will say no. Just say no. And it will shut down its operations, rather than have then infiltrated by spies and used surreptitiously to spread the NSA's global spook malware further. You can't force a company to do something if there's no company there to do it.

That one that went thru with the seppuku? She'll likely have a new service up and running in a few days or weeks. The customers who got dinged by the shutdown? They'll all get up and running on her new service. This is all 1s and 0s, remember? You don't have to demolish a car manufacturing plant, after all -- you're just wiping some VMs and reincorporating elsewhere. Lease new machines. Call it "lavabutt" on the new corporate docs, in Andorra. Sign on to the Privacy Seppuku pledge, as lavabutt, again. Off you go. Do you think it'll be hard to get customers -- old ones migrated over, and new ones alike? Think on that: a privacy company that shut down rather than be #snitchware... do you trust them, now?

That resilience flows from the service's digital nature, the availability of powerful but free software, and Moore's Law driving down the cost of commodity hardware. Put together, they make it easy to to recreate a business if it is shut down (apart from the lost data, of course.) The NSA will get this salient feature, CryptoStorm believes:

Spooks aren't dumb -- far from it. They do these kinds of analysis -- hell, they hire some of the best game theoretic minds in the world, and always have. Local cops might be power-drunk and unable to see how their actions play out over time; the NSA isn't any of that. They have whole buildings full of very smart people paid good money to think about this stuff. They won't get it wrong.

And the outcome is simple: if the Privacy Seppuku concept spreads, it becomes useless to target companies on the pledge list! You won't get what you want, you'll make some heroes who go out and do bigger stuff next, you'll out yourselves as dangerous thugs, your "secrecy" is shot to hell, and after all the effort involved you end up backwards from where you were before. That's the scenario, it's how it plays out. There's really no alternative scenario.

It's an optimistic vision, but the fact is that at the time of writing, only two services are listed as having made the Privacy Seppuku pledge -- Cryptocloud and Cryptocat. Until more join the club, it remains more a nice idea than a practical way of fighting back against today's mass surveillance.

And....

Standard part of Privacy Policies

I think that as a part of their privacy Policy, all sites should state what their actions will be in the event they are served with a National Security letter. Users will then have that information up front to aid in their decision whether to use the site, and not have to guess whether a site will secretly comply, challenge it, or close their doors.

No Other Option?

Wellll... There IS one other option for the government. If the government knows that a company is going to shut down as a response, then the government will simply stop asking first before they take the information that they want.

Faulty premise

"Spooks aren't dumb -- far from it. They do these kinds of analysis -- hell, they hire some of the best game theoretic minds in the world, and always have. Local cops might be power-drunk and unable to see how their actions play out over time; the NSA isn't any of that. They have whole buildings full of very smart people paid good money to think about this stuff. They won't get it wrong. "

They will and did. If they were so smart they would have realized early on what Ed Snowden had in his possesion and moved heaven and earth to make a deal with him to bring him home and stop the releases. Give him immunity throw a couple administrators on the sacrificial altar and move on.

These people are arrogant and believe themselves above the law and incapable of failure.

Maybe they will go Full Gestapo.

Now that Ladar Levison might potentially be arrested for espionage or conspiracy, that might halt companies from carrying out corporate seppuku, even if it means disappearing all non-cooperative corporate officers and replacing them with government agents.

We don't know. It'll be interesting to see the Levison fate (and I hope he has an offshore haven somewhere), but I'm sure if they made an example of Levison, later corporations would either bail early or fail to follow through on the pledge.

Re: Faulty premise

Nah, they didn't go the rational route with Snowden because they found themselves dealing with the kind of person that they had no experience with from their day to day lives: someone with a moral code higher than zero, and who was more interested in justice than power.

Add to that the fact that Snowden is no fool, and wouldn't have been tricked by some sacrificial lambs being tossed out to make it look like they had 'changed their ways', and the only way they could get him was the underhanded/political fashion.

Mind, that doesn't change the 'arrogant and above the law' line one bit, that I fully agree with, it suits them perfectly.

A gut-wrenching decision

Two problems with this:

- Once you're served with that order, to destroy any data may be a criminal offence (where is that link to the Lavabit guy's defence fund, by the way?)
- Announcing your intent means that anyone wanting to spy on your users will look for back doors.

A third problem being for listed companies - you try doing this, your shareholders will be after your head (as opposed to your guts).

I had to look up seppuku (although I had heard of the more popular term). Wikipedia had a very nice article on it. One very important thing to note is that it is incredibly difficult to intentionally hurt yourself - the human mind is trained to avoid harm, and seppuku intentionally causes enormous pain leading to death. I think Cryptocloud has chosen the right term. For the company owner making such a decision, they would face enormous pain.

Full Gestapo

If refusing such requests and preemptively shutting up shop is made illegal, and precedents are set to deter future copycats, the next best thing to do would be to comply with the orders but then shut up the business about 1 minute after the installation of government spywarez has been completed. That way you comply with the order but they get minimal useful data.

it shouldn't apply just to these services, it should apply to all. think what a difference it would have made had the various telcos decided to do something to protect their customers, instead of rolling over at the first hint of what was to come. now that would have been worth a good write up!

you get a court order

IF you think you can say no, and close your business instead your wrong, it's a court order and legal requirement, if you say no, you are in violation of the law, so not only will your business close, you'll go to prison as well !!!

Not So Easy

This is all 1s and 0s, remember? You don't have to demolish a car manufacturing plant, after all -- you're just wiping some VMs and reincorporating elsewhere. Lease new machines. Call it "lavabutt" on the new corporate docs, in Andorra. Sign on to the Privacy Seppuku pledge, as lavabutt, again. Off you go

Levison said in an interview that he could not just do that, for as a U.S. citizen, he is still subject to the nation's laws, regardless of where the company is inocrporated and it's servers are located.

Re: I wonder

That's an interesting question...

How by giving companies an ultimatum ("Allow us to spy or else") is that not quivalent to hostile government takeover, a serious affront to freedom? If they know that companies would rather shut down their services rather than play ball with the NSA, this cause-and-effect scenario would give the latter the ability to get rid of sites they don't like in a roundabout way. To use a real-world analogy, imagine if you opened a business and one day an NSA agent walked in and told you that he was going to secretly set up cameras on your property and that you didn't have a say in the matter. How would you feel?

Re: Full Gestapo

"yeah sorry, our investors pulled out so we had to close down..."
I find it hard to believe any court order could compel a private entity to continue operating a service at a loss.
Although, IANAL. so *shrug*.

Re: Maybe they will go Full Gestapo.

It didn't work out so well for Joseph Nacchio, former CEO of Qwest. Perhaps he really was guilty of insider trading, but it seems improbable he would have been prosecuted and given six years for it if he hadn't stood up to the NSA.

Re: I wonder

Considering that the theoretical court order would likely be Unconstitutional, I have a feeling Mike would refuse to comply until he's given indisputable proof it is Constitutional, & make a carefully worded post about being given an Unconstitutional court order.

Then again, what do I know? I've only been here since the SOPA Blackout.

Re: Faulty premise

1st there is something called "incompetence" which happens every minute of ever day, - around the globe. Errors and oversight will occur.

2nd is hubris, a byproduct of " Emperialistic" thinking. This hubris can lead to the underestimation of a threat or overconfidence in a mission achievement.

3rd there are some incredibly bright people who choose not to work for the spooks. And lets not underestimate the hacker mentality.

4th, there is a little something called morality. There do exist people who can't be bought and who will not compromise their principles.

This is where we get to Snowden. Listen to his interviews. "The truth is coming and it can't be stopped." There was no deal possible. Remember, he believed like many others, that Obama would bring change. He sat on all this knowledge waiting for those changes to happen.

There will be more I'm sure (whistleblowers) . I'm guessing that it's already too late for the government and the spooks to find them and shut them up.

Re:

However, they have WAY more power to fight back should they choose to. They have access to HUGE expert legal teams, plenty of political connections, and the funds to tie things up in the courts while they resist. Also with regards to a company like Google that is hugely popular, directly trying to shut them down would also likely be political suicide. Furthermore, think of all of the businesses in the US that are built and rely on the use of Google's products and services. An attempt by the government to shut them down over a flat refusal to comply would have a significant impact the entire US economy. What administration wants to be responsible for that if they suddenly went rogue and stopped complying and publicly stated everything that was occurring even if it was in violation of a court order?

Re: Not So Easy

He didn't say he couldn't do it. He said he wasn't willing to at this point because he doesn't want to relocate personally to another country. He could also always sell any corporate assets that he still has to another entity that would be willing to do just that. It doesn't have to be carried on necessarily by himself personally.

Re: Re: Re: Re: I wonder

Re: And....

it is the US govt that are the terrorists from our point of view. Terrorists and nazies of the USA war criminal regime with illegal invasions, DU and white phosphorous murders, drone murders, assassination squads, torture as official policy, illegal spying, what is it that americans fail to comprehend about their nation being a psychopathic entity run by international war criminals and thieves? Evil is as evil does, and while it is clear that US citizens are mostly in 'denial' the evidence is overwhelming, 911 was an inside job, the thin aluminium of wingtips will not cut thru the 14 inch thick steel beams surrounding the twin towers creating a 'cardboard cutout' plane shape so the stupid of america will believe there were planes... talk about retards! And now the nation has gone over the edge into butter disaster land... and those americans who failed to stop the criminals are getting the govt and lwas they deserve for not standing against evil when they should, so Corporate Sepuku'shows that not all americans support the evil 'TERROR STATE THAT IS THE USA'!

Re: I wonder

We should ask those people telling "if u got nothing to hinde then you don't need to fear the surveillance" to hand over every single piece of data they have to the NSA. Every single bit. Pictures (physcial or not), exact itineraries with detailed gps data, all your letter, documents, all of your private conversations, tapes of every sexual interaction you have with your partner, tapes of you using your bathroom... You know, commit privacy sepukku in the other end too. After all if you don't mind the intrusive surveillance you wouldn't mind giving all of your data to the Govt, right?